<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>elasticsearch-certutil | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'certutil.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/certutil.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/certutil.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/certutil.html" rel="nofollow" target="_blank">../en/certutil.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="commands.html">Command line tools</a></span>
»
<span class="breadcrumb-node">elasticsearch-certutil</span>
</div>
<div class="navheader">
<span class="prev">
<a href="certgen.html">« elasticsearch-certgen</a>
</span>
<span class="next">
<a href="elasticsearch-croneval.html">elasticsearch-croneval »</a>
</span>
</div>
<div class="chapter xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="certutil"></a>elasticsearch-certutil<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a><a class="xpack_tag" href="https://www.elastic.co/subscriptions"></a>
</h2>
</div></div></div>
<p>The <code class="literal">elasticsearch-certutil</code> command simplifies the creation of certificates for
use with Transport Layer Security (TLS) in the Elastic Stack.</p>
<h3>
<a id="_synopsis_2"></a>Synopsis<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h3>
<div class="pre_wrapper lang-shell">
<pre class="programlisting prettyprint lang-shell">bin/elasticsearch-certutil
(
(ca [--ca-dn &lt;name&gt;] [--days &lt;n&gt;] [--pem])

| (cert ([--ca &lt;file_path&gt;] | [--ca-cert &lt;file_path&gt; --ca-key &lt;file_path&gt;])
[--ca-dn &lt;name&gt;] [--ca-pass &lt;password&gt;] [--days &lt;n&gt;]
[--dns &lt;domain_name&gt;] [--in &lt;input_file&gt;] [--ip &lt;ip_addresses&gt;]
[--keep-ca-key] [--multiple] [--name &lt;file_name&gt;] [--pem])

| (csr [--dns &lt;domain_name&gt;] [--in &lt;input_file&gt;] [--ip &lt;ip_addresses&gt;]
[--name &lt;file_name&gt;])

[-E &lt;KeyValuePair&gt;] [--keysize &lt;bits&gt;] [--out &lt;file_path&gt;]
[--pass &lt;password&gt;]
)

| http

[-h, --help] ([-s, --silent] | [-v, --verbose])</pre>
</div>
<h3>
<a id="_description_2"></a>Description<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h3>
<p>You can specify one of the following modes: <code class="literal">ca</code>, <code class="literal">cert</code>, <code class="literal">csr</code>, <code class="literal">http</code>. The
<code class="literal">elasticsearch-certutil</code> command also supports a silent mode of operation to
enable easier batch operations.</p>
<h4>
<a id="certutil-ca"></a>CA mode<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h4>
<p>The <code class="literal">ca</code> mode generates a new certificate authority (CA). By default, it
produces a single PKCS#12 output file, which holds the CA certificate and the
private key for the CA. If you specify the <code class="literal">--pem</code> parameter, the command
generates a zip file, which contains the certificate and private key in PEM
format.</p>
<p>You can subsequently use these files as input for the <code class="literal">cert</code> mode of the command.</p>
<h4>
<a id="certutil-cert"></a>CERT mode<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h4>
<p>The <code class="literal">cert</code> mode generates X.509 certificates and private keys. By default, it
produces a single certificate and key for use on a single instance.</p>
<p>To generate certificates and keys for multiple instances, specify the
<code class="literal">--multiple</code> parameter, which prompts you for details about each instance.
Alternatively, you can use the <code class="literal">--in</code> parameter to specify a YAML file that
contains details about the instances.</p>
<p>An instance is any piece of the Elastic Stack that requires a TLS or SSL
certificate. Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats
might all require a certificate and private key. The minimum required
information for an instance is its name, which is used as the common name for
the certificate. The instance name can be a hostname value or a full
distinguished name. If the instance name would result in an invalid file or
directory name, you must also specify a file name in the <code class="literal">--name</code> command
parameter or in the <code class="literal">filename</code> field in an input YAML file.</p>
<p>You can optionally provide IP addresses or DNS names for each instance. If
neither IP addresses nor DNS names are specified, the Elastic stack products
cannot perform hostname verification and you might need to configure the
<code class="literal">verification_mode</code> security setting to <code class="literal">certificate</code> only. For more information
about this setting, see <a class="xref" href="security-settings.html" title="Security settings in Elasticsearch">Security settings</a>.</p>
<p>All certificates that are generated by this command are signed by a CA. You can
provide your own CA with the <code class="literal">--ca</code> or <code class="literal">--ca-cert</code> parameters. Otherwise, the
command automatically generates a new CA for you. For more information about
generating a CA, see the <a class="xref" href="certutil.html#certutil-ca" title="CA mode">CA mode of this command</a>.</p>
<p>By default, the <code class="literal">cert</code> mode produces a single PKCS#12 output file which holds
the instance certificate, the instance private key, and the CA certificate. If
you specify the <code class="literal">--pem</code> parameter, the command generates PEM formatted
certificates and keys and packages them into a zip file.
If you specify the <code class="literal">--keep-ca-key</code>, <code class="literal">--multiple</code> or <code class="literal">--in</code> parameters,
the command produces a zip file containing the generated certificates and keys.</p>
<h4>
<a id="certutil-csr"></a>CSR mode<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h4>
<p>The <code class="literal">csr</code> mode generates certificate signing requests (CSRs) that you can send
to a trusted certificate authority to obtain signed certificates. The signed
certificates must be in PEM or PKCS#12 format to work with Elasticsearch
security features.</p>
<p>By default, the command produces a single CSR for a single instance.</p>
<p>To generate CSRs for multiple instances, specify the <code class="literal">--multiple</code> parameter,
which prompts you for details about each instance. Alternatively, you can use
the <code class="literal">--in</code> parameter to specify a YAML file that contains details about the
instances.</p>
<p>The <code class="literal">csr</code> mode produces a single zip file which contains the CSRs and the
private keys for each instance. Each CSR is provided as a standard PEM
encoding of a PKCS#10 CSR. Each key is provided as a PEM encoding of an RSA
private key.</p>
<h4>
<a id="certutil-http"></a>HTTP mode<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h4>
<p>The <code class="literal">http</code> mode guides you through the process of generating certificates for
use on the HTTP (REST) interface for Elasticsearch. It asks you a number of questions in
order to generate the right set of files for your needs. For example, depending
on your choices, it might generate a zip file that contains a certificate
authority (CA), a certificate signing request (CSR), or certificates and keys
for use in Elasticsearch and Kibana. Each folder in the zip file contains a readme that
explains how to use the files.</p>
<h3>
<a id="_parameters_7"></a>Parameters<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h3>
<div class="variablelist">
<dl class="variablelist">
<dt>
<span class="term">
<code class="literal">ca</code>
</span>
</dt>
<dd>
Specifies to generate a new local certificate authority (CA). This
parameter cannot be used with the <code class="literal">csr</code> or <code class="literal">cert</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">cert</code>
</span>
</dt>
<dd>
Specifies to generate new X.509 certificates and keys.
This parameter cannot be used with the <code class="literal">csr</code> or <code class="literal">ca</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">csr</code>
</span>
</dt>
<dd>
Specifies to generate certificate signing requests. This parameter
cannot be used with the <code class="literal">ca</code> or <code class="literal">cert</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">http</code>
</span>
</dt>
<dd>
Generates a new certificate or certificate request for the Elasticsearch HTTP
interface.
</dd>
<dt>
<span class="term">
<code class="literal">--ca &lt;file_path&gt;</code>
</span>
</dt>
<dd>
Specifies the path to an existing CA key pair
(in PKCS#12 format). This parameter cannot be used with the <code class="literal">ca</code> or <code class="literal">csr</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">--ca-cert &lt;file_path&gt;</code>
</span>
</dt>
<dd>
Specifies the path to an existing CA certificate (in
PEM format). You must also specify the <code class="literal">--ca-key</code> parameter. The <code class="literal">--ca-cert</code>
parameter cannot be used with the <code class="literal">ca</code> or <code class="literal">csr</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">--ca-dn &lt;name&gt;</code>
</span>
</dt>
<dd>
Defines the <em>Distinguished Name</em> (DN) that is used for the
generated CA certificate. The default value is
<code class="literal">CN=Elastic Certificate Tool Autogenerated CA</code>. This parameter cannot be used
with the <code class="literal">csr</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">--ca-key &lt;file_path&gt;</code>
</span>
</dt>
<dd>
Specifies the path to an existing CA private key (in
PEM format). You must also specify the <code class="literal">--ca-cert</code> parameter. The <code class="literal">--ca-key</code>
parameter cannot be used with the <code class="literal">ca</code> or <code class="literal">csr</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">--ca-pass &lt;password&gt;</code>
</span>
</dt>
<dd>
Specifies the password for an existing CA private key
or the generated CA private key. This parameter cannot be used with the <code class="literal">ca</code> or
<code class="literal">csr</code> parameters.
</dd>
<dt>
<span class="term">
<code class="literal">--days &lt;n&gt;</code>
</span>
</dt>
<dd>
Specifies an integer value that represents the number of days the
generated certificates are valid. The default value is <code class="literal">1095</code>. This parameter
cannot be used with the <code class="literal">csr</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">--dns &lt;domain_name&gt;</code>
</span>
</dt>
<dd>
Specifies a comma-separated list of DNS names. This
parameter cannot be used with the <code class="literal">ca</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">-E &lt;KeyValuePair&gt;</code>
</span>
</dt>
<dd>
Configures a setting.
</dd>
<dt>
<span class="term">
<code class="literal">-h, --help</code>
</span>
</dt>
<dd>
Returns all of the command parameters.
</dd>
<dt>
<span class="term">
<code class="literal">--in &lt;input_file&gt;</code>
</span>
</dt>
<dd>
Specifies the file that is used to run in silent mode. The
input file must be a YAML file. This parameter cannot be used with the <code class="literal">ca</code>
parameter.
</dd>
<dt>
<span class="term">
<code class="literal">--ip &lt;IP_addresses&gt;</code>
</span>
</dt>
<dd>
Specifies a comma-separated list of IP addresses. This
parameter cannot be used with the <code class="literal">ca</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">--keep-ca-key</code>
</span>
</dt>
<dd>
When running in <code class="literal">cert</code> mode with an automatically-generated
CA, specifies to retain the CA private key for future use.
</dd>
<dt>
<span class="term">
<code class="literal">--keysize &lt;bits&gt;</code>
</span>
</dt>
<dd>
Defines the number of bits that are used in generated RSA keys. The default
value is <code class="literal">2048</code>.
</dd>
<dt>
<span class="term">
<code class="literal">--multiple</code>
</span>
</dt>
<dd>
Specifies to generate files for multiple instances. This parameter cannot be
used with the <code class="literal">ca</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">--name &lt;file_name&gt;</code>
</span>
</dt>
<dd>
Specifies the name of the generated certificate. This parameter cannot be used
with the <code class="literal">ca</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">--out &lt;file_path&gt;</code>
</span>
</dt>
<dd>
Specifies a path for the output files.
</dd>
<dt>
<span class="term">
<code class="literal">--pass &lt;password&gt;</code>
</span>
</dt>
<dd>
<p>
Specifies the password for the generated private keys.
</p>
<p>Keys stored in PKCS#12 format are always password protected, however,
this password may be <em>blank</em>. If you want to specify a blank password
without a prompt, use <code class="literal">--pass ""</code> (with no <code class="literal">=</code>) on the command line.</p>
<p>Keys stored in PEM format are password protected only if the
<code class="literal">--pass</code> parameter is specified. If you do not supply an argument for the
<code class="literal">--pass</code> parameter, you are prompted for a password.
Encrypted PEM files do not support blank passwords (if you do not
wish to password-protect your PEM keys, then do not specify
<code class="literal">--pass</code>).</p>
</dd>
<dt>
<span class="term">
<code class="literal">--pem</code>
</span>
</dt>
<dd>
Generates certificates and keys in PEM format instead of PKCS#12. This
parameter cannot be used with the <code class="literal">csr</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">-s, --silent</code>
</span>
</dt>
<dd>
Shows minimal output.
</dd>
<dt>
<span class="term">
<code class="literal">-v, --verbose</code>
</span>
</dt>
<dd>
Shows verbose output.
</dd>
</dl>
</div>
<h3>
<a id="_examples_6"></a>Examples<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h3>
<p>The following command generates a CA certificate and private key in PKCS#12
format:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-certutil ca</pre>
</div>
<p>You are prompted for an output filename and a password. Alternatively, you can
specify the <code class="literal">--out</code> and <code class="literal">--pass</code> parameters.</p>
<p>You can then generate X.509 certificates and private keys by using the new
CA. For example:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12</pre>
</div>
<p>You are prompted for the CA password and for an output filename and password.
Alternatively, you can specify the <code class="literal">--ca-pass</code>, <code class="literal">--out</code>, and <code class="literal">--pass</code> parameters.</p>
<p>By default, this command generates a file called <code class="literal">elastic-certificates.p12</code>,
which you can copy to the relevant configuration directory for each Elastic
product that you want to configure. For more information, see
<a class="xref" href="ssl-tls.html" title="Setting up TLS on a cluster">Setting up TLS on a cluster</a>.</p>
<h4>
<a id="certutil-silent"></a>Using <code class="literal">elasticsearch-certutil</code> in Silent Mode<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/certutil.asciidoc">edit</a>
</h4>
<p>To use the silent mode of operation, you must create a YAML file that contains
information about the instances. It must match the following format:</p>
<div class="pre_wrapper lang-yaml">
<pre class="programlisting prettyprint lang-yaml">instances:
  - name: "node1" <a id="CO542-1"></a><i class="conum" data-value="1"></i>
    ip: <a id="CO542-2"></a><i class="conum" data-value="2"></i>
      - "192.0.2.1"
    dns: <a id="CO542-3"></a><i class="conum" data-value="3"></i>
      - "node1.mydomain.com"
  - name: "node2"
    ip:
      - "192.0.2.2"
      - "198.51.100.1"
  - name: "node3"
  - name: "node4"
    dns:
      - "node4.mydomain.com"
      - "node4.internal"
  - name: "CN=node5,OU=IT,DC=mydomain,DC=com"
    filename: "node5" <a id="CO542-4"></a><i class="conum" data-value="4"></i></pre>
</div>
<div class="calloutlist">
<table border="0" summary="Callout list">
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO542-1"><i class="conum" data-value="1"></i></a></p>
</td>
<td align="left" valign="top">
<p>The name of the instance. This can be a simple string value or can be a
Distinguished Name (DN). This is the only required field.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO542-2"><i class="conum" data-value="2"></i></a></p>
</td>
<td align="left" valign="top">
<p>An optional array of strings that represent IP Addresses for this instance.
Both IPv4 and IPv6 values are allowed. The values are added as Subject
Alternative Names.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO542-3"><i class="conum" data-value="3"></i></a></p>
</td>
<td align="left" valign="top">
<p>An optional array of strings that represent DNS names for this instance.
The values are added as Subject Alternative Names.</p>
</td>
</tr>
<tr>
<td align="left" valign="top" width="5%">
<p><a href="#CO542-4"><i class="conum" data-value="4"></i></a></p>
</td>
<td align="left" valign="top">
<p>The filename to use for this instance. This name is used as the name of the
directory that contains the instance’s files in the output. It is also used in
the names of the files within the directory. This filename should not have an
extension. Note: If the <code class="literal">name</code> provided for the instance does not represent a
valid filename, then the <code class="literal">filename</code> field must be present.</p>
</td>
</tr>
</table>
</div>
<p>When your YAML file is ready, you can use the <code class="literal">elasticsearch-certutil</code> command
to generate certificates or certificate signing requests. Simply use the <code class="literal">--in</code>
parameter to specify the location of the file. For example:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-certutil cert --silent --in instances.yml --out test1.zip --pass testpassword</pre>
</div>
<p>This command generates a compressed <code class="literal">test1.zip</code> file. After you decompress the
output file, there is a directory for each instance that was listed in the
<code class="literal">instances.yml</code> file. Each instance directory contains a single PKCS#12 (<code class="literal">.p12</code>)
file, which contains the instance certificate, instance private key, and CA
certificate.</p>
<p>You an also use the YAML file to generate certificate signing requests. For
example:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-certutil csr --silent --in instances.yml --out test2.zip --pass testpassword</pre>
</div>
<p>This command generates a compressed file, which contains a directory for each
instance. Each instance directory contains a certificate signing request
(<code class="literal">*.csr</code> file) and private key (<code class="literal">*.key</code> file).</p>
</div>
<div class="navfooter">
<span class="prev">
<a href="certgen.html">« elasticsearch-certgen</a>
</span>
<span class="next">
<a href="elasticsearch-croneval.html">elasticsearch-croneval »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>